Topic: Access to Ledger Nano S (2018 version) without PIN and seed words? (Read 280 times)

Quote from: dkbit98 on November 03, 2022, 02:52:53 PM

The situation is complex. In short: the owner was running a badly structured business and died. The business partners are trying to recover their funds from the wallet. There is nothing criminal.

I understand this, but if he died he probably left some will and documents containing seed words and PIN, maybe even passphrase(s).

The documents (and maybe the seed words) are stuck in court. The crypto business the owner was running was formalized loosely on a blockchain and the court does not understand nor accept that. The business partners have spent years without success in that front.

Does it have something to do with the exchange which owner suddenly died but later it was rumored that he did not? A lawsuit was filed against him for scamming and then disappearing. I can not remember the story correctly but there was Canadian (maybe) exchange few years ago that was gone by telling this story.

I understand what you're talking about and it would be funny that it turns out that way. Although hardly anyone would admit to being involved in that story. I also believe that many users of the exchange would have a lot of questions for those partners of the owner of this hardware wallet device, if they are on the bitcointalk forum. So, I think we will not wait for the coming out and perhaps OP has nothing to do with that story. Who knows.

AB de Royse777

legendary

Activity: 2464

Merit: 3878

Hire Bitcointalk Camp. Manager @ r7promotions.com

Quote from: dkbit98 on November 03, 2022, 02:52:53 PM

The situation is complex. In short: the owner was running a badly structured business and died. The business partners are trying to recover their funds from the wallet. There is nothing criminal.

I understand this, but if he died he probably left some will and documents containing seed words and PIN, maybe even passphrase(s).

The documents (and maybe the seed words) are stuck in court. The crypto business the owner was running was formalized loosely on a blockchain and the court does not understand nor accept that. The business partners have spent years without success in that front.

Does it have something to do with the exchange which owner suddenly died but later it was rumored that he did not? A lawsuit was filed against him for scamming and then disappearing. I can not remember the story correctly but there was Canadian (maybe) exchange few years ago that was gone by telling this story.

n0nce

hero member

Activity: 882

Merit: 5834

not your keys, not your coins!

Quote from: n0nce on November 03, 2022, 09:01:06 PM

No no, the idea is to flash custom firmware on the Ledger's main MCU, leaving the secure element (and the seed stored therein) alone. You can do that before or after usage, should not matter.
This custom firmware can then just ask the secure element to sign a transaction sending all funds to a certain address and it should indeed return the signed transaction.

You do need to bypass firmware verification (performed by secure element), though, as described here.
https://youtu.be/Y1OBIGslgGM?t=1551

It is true, that I could put a custom software to Ledger's main MCU and leaving the secure element with the keys as it is.
However, the secure element takes PIN code as an argument when doing actions (like signing transaction for example) with the keys.

So with custom firmware I could do all kind of interesting tricks with the Ledger, but without the PIN code I still have no access to the secure element and it's functions nor keys.
And when supplying 3 incorrect PIN-s to the secure element then it will just erase the keys.

True, true. There may be an implementation bug; especially due to the closed-source STM32 code, it may not have been spotted yet.
Basically, you're looking for a hardware / software n-day, in case your 2018 Ledger was never updated. The hardware should be unmodified from 2018 to 2022, so when looking for hardware bugs, that will actually be 0-days. Unfortunately, I'm not aware of firmware bugs that are easily exploitable on old Ledgers, like on Trezor Model One.

Quote from: dkbit98 on November 03, 2022, 02:52:53 PM

Quote from: dkbit98 on November 03, 2022, 02:52:53 PM

The situation is complex. In short: the owner was running a badly structured business and died. The business partners are trying to recover their funds from the wallet. There is nothing criminal.

I understand this, but if he died he probably left some will and documents containing seed words and PIN, maybe even passphrase(s).

The documents (and maybe the seed words) are stuck in court. The crypto business the owner was running was formalized loosely on a blockchain and the court does not understand nor accept that. The business partners have spent years without success in that front.

You can't hack hardware wallets so easy, or governments wouldn't pay millions to do it somehow.

I could pay 6-7 figures for this work.

Have you tried contacting reputable people with knowledge / experience in this field yet? That's probably a workable sum of money.

mart

copper member

Activity: 58

Merit: 0

Quote from: n0nce on November 03, 2022, 09:01:06 PM

No no, the idea is to flash custom firmware on the Ledger's main MCU, leaving the secure element (and the seed stored therein) alone. You can do that before or after usage, should not matter.
This custom firmware can then just ask the secure element to sign a transaction sending all funds to a certain address and it should indeed return the signed transaction.

You do need to bypass firmware verification (performed by secure element), though, as described here.
https://youtu.be/Y1OBIGslgGM?t=1551

It is true, that I could put a custom software to Ledger's main MCU and leaving the secure element with the keys as it is.
However, the secure element takes PIN code as an argument when doing actions (like signing transaction for example) with the keys.

So with custom firmware I could do all kind of interesting tricks with the Ledger, but without the PIN code I still have no access to the secure element and it's functions nor keys.
And when supplying 3 incorrect PIN-s to the secure element then it will just erase the keys.

Quote from: dkbit98 on November 03, 2022, 02:52:53 PM

Quote from: dkbit98 on November 03, 2022, 02:52:53 PM

Is there any way to get access to the funds on Ledger Nano S (from year 2018) without the PIN code?
I also don't have the seed words.

How do you suppose to do that?

No idea so far. That's what I'm trying to find out here

Quote from: dkbit98 on November 03, 2022, 02:52:53 PM

The situation is complex. In short: the owner was running a badly structured business and died. The business partners are trying to recover their funds from the wallet. There is nothing criminal.

I understand this, but if he died he probably left some will and documents containing seed words and PIN, maybe even passphrase(s).

The documents (and maybe the seed words) are stuck in court. The crypto business the owner was running was formalized loosely on a blockchain and the court does not understand nor accept that. The business partners have spent years without success in that front.

You can't hack hardware wallets so easy, or governments wouldn't pay millions to do it somehow.

I could pay 6-7 figures for this work.

[moderator's note: consecutive posts merged]

n0nce

hero member

Activity: 882

Merit: 5834

not your keys, not your coins!

Quote from: mart on November 03, 2022, 02:00:45 PM

Quote from: NeuroticFish on November 03, 2022, 01:54:46 PM

I've found at some point these writings: https://saleemrashid.com/2018/03/20/breaking-ledger-security-model/
I don't know if you're familiar with them, unfortunately I didn't get to read much either, but a quick look seems to tell that getting the info is possible, especially if you're lucky to have an old firmware on it (1.3.1).

Thanks for that, but I have already went through the linked article. Even contacted the author

The attack described by Saleem Rashid in the article can be used to put a custom software to the Ledger Nano S before the usage by the user.
In my case that unfortunately doesn't help Undecided

No no, the idea is to flash custom firmware on the Ledger's main MCU, leaving the secure element (and the seed stored therein) alone. You can do that before or after usage, should not matter.
This custom firmware can then just ask the secure element to sign a transaction sending all funds to a certain address and it should indeed return the signed transaction.

You do need to bypass firmware verification (performed by secure element), though, as described here.
https://youtu.be/Y1OBIGslgGM?t=1551

dkbit98

legendary

Activity: 2212

Merit: 7064

Is there any way to get access to the funds on Ledger Nano S (from year 2018) without the PIN code?
I also don't have the seed words.

How do you suppose to do that?
Seed words backup is mandatory to have, and it's even better if you have multiple copies in different locations.
If you don't have both PIN and seed words I can only consider you ~~stole~~ found this device from someone else, or you found it somewhere.

So the only way seems to be physically extracting the information from the chip.
Does anyone know a lab or someone who is able to extract the needed information from the chip?

You could in theory only extract encrypted stuff that means nothing to you and it can't be used for anything, unless Ledger and chip manufacturer have some backdoor access.
I wouldn't be surprised if they do have something like this, when everything is closed source and hush hush in their business.

Quote from: NeuroticFish on November 03, 2022, 01:54:46 PM

The situation is complex. In short: the owner was running a badly structured business and died. The business partners are trying to recover their funds from the wallet. There is nothing criminal.

I understand this, but if he died he probably left some will and documents containing seed words and PIN, maybe even passphrase(s).
You can't hack hardware wallets so easy, or governments wouldn't pay millions to do it somehow.

mart

copper member

Activity: 58

Merit: 0

I've found at some point these writings: https://saleemrashid.com/2018/03/20/breaking-ledger-security-model/
I don't know if you're familiar with them, unfortunately I didn't get to read much either, but a quick look seems to tell that getting the info is possible, especially if you're lucky to have an old firmware on it (1.3.1).

Thanks for that, but I have already went through the linked article. Even contacted the author

The attack described by Saleem Rashid in the article can be used to put a custom software to the Ledger Nano S before the usage by the user.
In my case that unfortunately doesn't help Undecided

NeuroticFish

legendary

Activity: 3668

Merit: 6382

Looking for campaign manager? Contact icopress!

Quote from: ?? on ??

The Ledger Nano S has a dual-chip architecture. There is one normal chip for buttons, screen, USB, etc. And another one -- the secure element -- for all actions with private keys.
It's actually very good and clever design. And very hard to hack Cheesy

I've found at some point these writings: https://saleemrashid.com/2018/03/20/breaking-ledger-security-model/
I don't know if you're familiar with them, unfortunately I didn't get to read much either, but a quick look seems to tell that getting the info is possible, especially if you're lucky to have an old firmware on it (1.3.1).

mart

copper member

Activity: 58

Merit: 0

Quote from: NeuroticFish on November 03, 2022, 12:51:20 PM

Quote from: AB de Royse777 on November 03, 2022, 12:46:02 PM

Is there any way to get access to the funds on Ledger Nano S (from year 2018) without the PIN code?

Since you don't have neither the PIN, nor the private key,... is this your Ledger? I guess not. And then, why would we help you steal somebody else's money? "paid in abundance" sound cool, but "accessory to crime" doesn't.

The situation is complex. In short: the owner was running a badly structured business and died. The business partners are trying to recover their funds from the wallet. There is nothing criminal.

The way I understand it, you do not need the same pin. Pin are just to keep the device locked. All you need is the seed phrase. If you have it then you can use any ledger device with any pin in it and restore the wallet.